osintkit 0.5.0__tar.gz → 0.6.0__tar.gz

{osintkit-0.5.0 → osintkit-0.6.0}/CHANGELOG.md

@@ -6,6 +6,13 @@ All notable changes are recorded here. The format follows
 
 ## Unreleased
 
+## 0.6.0 — 2026-11-02
+
+### Added
+
+- `infostealer` collector for Hudson Rock stealer logs across email, username, and domain
+- any stealer infection forces a high risk floor and a rotate-everything recommendation
+
 ## 0.5.0 — 2026-11-02
 
 ### Added

{osintkit-0.5.0 → osintkit-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: osintkit
-Version: 0.5.0
+Version: 0.6.0
 Summary: Public-data OSINT aggregator for emails, usernames, domains, and companies
 Project-URL: Homepage, https://github.com/sjdsjadjajdjsa/osintkit
 Project-URL: Issues, https://github.com/sjdsjadjajdjsa/osintkit/issues
@@ -138,6 +138,8 @@ the model fail.
   and XposedOrNot catalogues. Those catalogues are free; only HIBP *account* checks need a key.
 - **Email domains follow the address.** An email lookup also checks the domain's DNS, mail
   posture, and WHOIS, marked as derived.
+- **Info-stealer logs.** Hudson Rock reports machines infected by stealers that saved
+  credentials, with dates and hostnames; one infection forces a high risk floor.
 - **Risk floor.** Breach count and credential types set a floor the model may exceed but never
   undercut.
 - **Cached everything.** 24h default, shorter for volatile sources; repeat prompts cost nothing.
@@ -159,6 +161,9 @@ against the public HIBP and XposedOrNot catalogues for date, exposed fields, and
 the report can say "LinkedIn, 2021-06, emails and password hashes" instead of a bare name. Add a
 `HIBP_API_KEY` (about $4/month) to get per-account membership with the same metadata, plus pastes.
 
+Stealer logs matter more than most breaches: the credentials were live on an infected machine,
+not just leaked years ago. They are queried for every target type, keyless.
+
 Passwords are checked separately with `osintkit password`: Pwned Passwords covers hundreds of
 millions of leaked passwords, needs no key, and only the first five SHA-1 characters leave the
 machine.

{osintkit-0.5.0 → osintkit-0.6.0}/README.md

@@ -106,6 +106,8 @@ the model fail.
   and XposedOrNot catalogues. Those catalogues are free; only HIBP *account* checks need a key.
 - **Email domains follow the address.** An email lookup also checks the domain's DNS, mail
   posture, and WHOIS, marked as derived.
+- **Info-stealer logs.** Hudson Rock reports machines infected by stealers that saved
+  credentials, with dates and hostnames; one infection forces a high risk floor.
 - **Risk floor.** Breach count and credential types set a floor the model may exceed but never
   undercut.
 - **Cached everything.** 24h default, shorter for volatile sources; repeat prompts cost nothing.
@@ -127,6 +129,9 @@ against the public HIBP and XposedOrNot catalogues for date, exposed fields, and
 the report can say "LinkedIn, 2021-06, emails and password hashes" instead of a bare name. Add a
 `HIBP_API_KEY` (about $4/month) to get per-account membership with the same metadata, plus pastes.
 
+Stealer logs matter more than most breaches: the credentials were live on an infected machine,
+not just leaked years ago. They are queried for every target type, keyless.
+
 Passwords are checked separately with `osintkit password`: Pwned Passwords covers hundreds of
 millions of leaked passwords, needs no key, and only the first five SHA-1 characters leave the
 machine.

{osintkit-0.5.0 → osintkit-0.6.0}/docs/REFERENCE.md

@@ -6,6 +6,7 @@ Everything the README leaves out: every flag, every collector, storage, and fail
 
 | Collector | Targets | Source | Needs key |
 | --- | --- | --- | --- |
+| `infostealer` | email / username / domain | Hudson Rock stealer logs | no |
 | `hibp_breaches`, `hibp_pastes` | email | Have I Been Pwned | yes |
 | `xposed_or_not`, `leakcheck_public` | email | free public breach indexes | no |
 | `gravatar` | email | Gravatar | no |
@@ -61,6 +62,15 @@ Explicit `--base-url` and `--model` beat both the provider and the prefix. Tempe
 Per-command: `--json`, `--markdown`, `-o/--out`, `--raw`, `--offline`, `--dry-run`, `--only`, `--skip`,
 `--ports`, `--fail-fast`, `-c/--concurrency`, `--limit`, `--show`, `--days`, `--clear`, `--deep`.
 
+## Info-stealer logs
+
+`infostealer` queries Hudson Rock's keyless endpoint for infections that saved credentials on a
+compromised machine. It returns the infection count, dates, hostnames, IPs, antivirus state, and
+masked logins and passwords. Any infection forces a `high` risk floor; masked values are shown as
+the source provides them and are not usable as credentials.
+
+The address goes to Hudson Rock; nothing else does.
+
 ## Breach catalogue enrichment
 
 Breach names from free indexes are joined against `haveibeenpwned.com/api/v3/breaches` (keyless

{osintkit-0.5.0 → osintkit-0.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "osintkit"
-version = "0.5.0"
+version = "0.6.0"
 description = "Public-data OSINT aggregator for emails, usernames, domains, and companies"
 readme = "README.md"
 requires-python = ">=3.12"

{osintkit-0.5.0 → osintkit-0.6.0}/src/osintkit/__init__.py

@@ -1,3 +1,3 @@
 """osintkit: a public-data OSINT aggregator."""
 
-__version__ = "0.5.0"
+__version__ = "0.6.0"

{osintkit-0.5.0 → osintkit-0.6.0}/src/osintkit/collectors/__init__.py

@@ -8,6 +8,7 @@ from . import (  # noqa: F401  (import order matters: side-effect registration)
     ct,
     dns,
     github,
+    infostealer,
     pastes,
     ports,
     subdomains,

osintkit-0.6.0/src/osintkit/collectors/infostealer.py

@@ -0,0 +1,71 @@
+"""Info-stealer log exposure via Hudson Rock's keyless endpoint."""
+
+from __future__ import annotations
+
+from urllib.parse import quote
+
+from .base import Context, collector
+
+BASE = "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by"
+MAX_STEALERS = 5
+
+
+def _clean(value: object) -> str | None:
+    text = str(value or "").strip()
+    if not text or text.lower() == "not found":
+        return None
+    return text[:120]
+
+
+def _summary(body: object) -> dict:
+    if not isinstance(body, dict):
+        return {"infected": False, "infections": 0, "stealers": []}
+    raw = body.get("stealers") or []
+    stealers = []
+    for row in raw[:MAX_STEALERS]:
+        if not isinstance(row, dict):
+            continue
+        stealers.append(
+            {
+                "date": (row.get("date_compromised") or "")[:10] or None,
+                "computer": _clean(row.get("computer_name")),
+                "os": _clean(row.get("operating_system")),
+                "ip": _clean(row.get("ip")),
+                "antiviruses": [av for av in row.get("antiviruses") or [] if av != "None"][:5],
+                "logins": [str(item) for item in (row.get("top_logins") or [])[:5]],
+                "passwords": [str(item) for item in (row.get("top_passwords") or [])[:5]],
+            }
+        )
+    return {
+        "infected": bool(stealers),
+        "infections": len(raw),
+        "corporate_services": body.get("total_corporate_services"),
+        "user_services": body.get("total_user_services"),
+        "stealers": stealers,
+        "source": "hudsonrock",
+    }
+
+
+async def _lookup(ctx: Context, kind: str) -> dict:
+    response = await ctx.http.get(
+        f"{BASE}-{kind}",
+        namespace="hudsonrock",
+        params={kind: ctx.target},
+        empty_on=(404, 429),
+        timeout=ctx.http_timeout or 45,
+    )
+    if response.status_code != 200:
+        return {"infected": False, "infections": 0, "stealers": [], "note": f"HTTP {response.status_code}"}
+    try:
+        return _summary(response.json())
+    except ValueError:
+        return {"infected": False, "infections": 0, "stealers": [], "note": "non-JSON"}
+
+
+@collector("infostealer", ("email", "username", "domain"), "Info-stealer log infections", order=5, ttl=43200)
+async def infostealer(ctx: Context) -> dict:
+    kind = {"email": "email", "username": "username", "domain": "domain"}[ctx.target_type]
+    result = await _lookup(ctx, kind)
+    result["target_kind"] = kind
+    result["checked"] = quote(ctx.target)
+    return result

{osintkit-0.5.0 → osintkit-0.6.0}/src/osintkit/normalise.py

@@ -14,7 +14,7 @@ SEVERITY = ("low", "medium", "high")
 MAX_PROMPT_BREACHES = 15
 
 
-def signals_for(merged: list[dict[str, Any]]) -> dict[str, Any]:
+def signals_for(merged: list[dict[str, Any]], infections: int = 0) -> dict[str, Any]:
     """Compute risk signals the model can check itself against."""
     credential = [
         entry
@@ -22,10 +22,12 @@ def signals_for(merged: list[dict[str, Any]]) -> dict[str, Any]:
         if any(CREDENTIAL_RE.search(str(kind)) for kind in entry.get("data_types", []))
     ]
     count = len(merged)
+    floor = "high" if infections else _floor(count, len(credential))
     return {
         "breach_count": count,
         "credential_bearing": len(credential),
-        "risk_floor": _floor(count, len(credential)),
+        "stealer_infections": infections,
+        "risk_floor": floor,
     }
 
 

{osintkit-0.5.0 → osintkit-0.6.0}/src/osintkit/offline.py

@@ -91,6 +91,15 @@ def _infrastructure(results: list[CollectorResult], report_notes: list[str]) ->
     if isinstance(wildcard, dict) and wildcard.get("wildcard"):
         notes.append("Wildcard DNS is enabled, so unknown labels resolve")
 
+    stealer = _data(results, "infostealer")
+    if isinstance(stealer, dict) and stealer.get("infections"):
+        first = (stealer.get("stealers") or [{}])[0]
+        notes.append(
+            f"{stealer['infections']} info-stealer infection(s)"
+            + (f", latest {first.get('date')}" if first.get("date") else "")
+            + (f" on {first.get('computer')}" if first.get("computer") else "")
+        )
+
     whois = _data(results, "whois_registration")
     if isinstance(whois, dict) and whois.get("registrar"):
         parts = [f"registrar {whois['registrar']}"]
@@ -117,9 +126,16 @@ def _infrastructure(results: list[CollectorResult], report_notes: list[str]) ->
 
 
 def _recommendations(
-    creds: int, mail: dict | None, wildcard: bool, ports: list[int], breach_count: int
+    creds: int,
+    mail: dict | None,
+    wildcard: bool,
+    ports: list[int],
+    breach_count: int,
+    infections: int = 0,
 ) -> list[str]:
     recs: list[str] = []
+    if infections:
+        recs.append("Change every password saved on the infected machine, then sign out all sessions")
     if creds:
         recs.append("Rotate passwords for the affected services and enable MFA where offered")
     elif breach_count:
@@ -204,5 +220,6 @@ def build(
             wildcard,
             risky,
             signals["breach_count"],
+            int((_data(results, "infostealer") or {}).get("infections") or 0),
         ),
     )

{osintkit-0.5.0 → osintkit-0.6.0}/src/osintkit/pipeline.py

@@ -186,7 +186,11 @@ async def execute(
             logger.event("breaches_merged", duplicates=duplicates)
 
         merged_breaches = next((r.data for r in prompt_results if r.collector == "breach_index"), [])
-        signals = normalise.signals_for(merged_breaches)
+        stealer = next((r.data for r in prompt_results if r.collector == "infostealer"), {})
+        infections = int((stealer or {}).get("infections") or 0)
+        signals = normalise.signals_for(merged_breaches, infections)
+        if infections:
+            report.notes.append(f"{infections} info-stealer infection(s) observed")
 
         bundle = PromptBundle(
             target=target,

osintkit-0.6.0/tests/test_infostealer.py

@@ -0,0 +1,64 @@
+import httpx
+import respx
+
+from osintkit.collectors import infostealer
+
+URL = "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-email"
+
+
+@respx.mock
+async def test_infections_are_summarised(make_context):
+    ctx = make_context("a@b.co", "email")
+    respx.get(URL).mock(
+        return_value=httpx.Response(
+            200,
+            json={
+                "stealers": [
+                    {
+                        "date_compromised": "2026-10-31T00:00:00.000Z",
+                        "computer_name": "DESKTOP-1 (David)",
+                        "operating_system": "Not Found",
+                        "ip": "105.118.***.**",
+                        "antiviruses": ["None"],
+                        "top_logins": ["a***n"],
+                        "top_passwords": ["v**************E"],
+                    }
+                ],
+                "total_corporate_services": 3,
+                "total_user_services": 9,
+            },
+        )
+    )
+    result = await infostealer.infostealer(ctx)
+    assert result["infected"] is True
+    assert result["infections"] == 1
+    assert result["stealers"][0]["date"] == "2026-10-31"
+    assert result["stealers"][0]["os"] is None
+    assert result["stealers"][0]["antiviruses"] == []
+
+
+@respx.mock
+async def test_clean_target(make_context):
+    ctx = make_context("a@b.co", "email")
+    respx.get(URL).mock(return_value=httpx.Response(200, json={"stealers": []}))
+    result = await infostealer.infostealer(ctx)
+    assert result["infected"] is False
+
+
+@respx.mock
+async def test_rate_limited_is_not_an_error(make_context):
+    ctx = make_context("a@b.co", "email")
+    respx.get(URL).mock(return_value=httpx.Response(429))
+    result = await infostealer.infostealer(ctx)
+    assert result["infections"] == 0
+    assert "429" in result["note"]
+
+
+@respx.mock
+async def test_domain_uses_domain_endpoint(make_context):
+    ctx = make_context("example.com", "domain")
+    route = respx.get("https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain").mock(
+        return_value=httpx.Response(200, json={"stealers": []})
+    )
+    await infostealer.infostealer(ctx)
+    assert route.calls[0].request.url.params["domain"] == "example.com"

{osintkit-0.5.0 → osintkit-0.6.0}/tests/test_normalise.py

@@ -116,3 +116,12 @@ def test_dict_shaped_sources_are_merged():
     row = next(r for r in kept if r.collector == "breach_index").data[0]
     assert row["sources"] == ["leakcheck_public", "xposedornot"]
     assert row["date"] == "2020-01-01"
+
+
+def test_infections_force_a_high_floor():
+    assert normalise.signals_for([], infections=1)["risk_floor"] == "high"
+    assert normalise.signals_for([], infections=0)["risk_floor"] == "low"
+
+
+def test_infections_are_counted_in_signals():
+    assert normalise.signals_for([], infections=3)["stealer_infections"] == 3